2 Answers
2

Basically, df reads the superblock only and trusts it completely. du reads each object and sums them up.

Also, a running process can keep a deleted file open. This means the space will still be reserved and seen by df, but since du will no longer see a reference to that file in the directory tree, it cannot see those reserved blocks.